Repository navigation
Use the github.com/x6c-co/rypt module for API calls - #2
Merged
Merged
Conversation
Replace internal/client with the rypt Go SDK v0.1.0, which carries over its hardening: https only, no redirects, no plain-HTTP proxying, sanitized server text with the token redacted, bounded responses, and the same retries for wrap and unwrap. The SDK passes the wrapped DEK as bytes, so encrypt writes it to the header as standard padded base64, the same string the API sent, and decrypt decodes it before unwrapping. A header whose wrapped DEK is not base64 cannot have come from the API: it is now refused locally as a damaged header, exit code 4, without spending an operation, where it used to be sent to the API and refused there with exit code 1. scripts/probe.go checks RYPT_API_URL with rypt.NewClient. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NTEjHbdKp83qgQgmqR1BJ6
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces
internal/clientwith the new Go SDK,github.com/x6c-co/ryptv0.1.0, so the CLI and other projects share one API client.The SDK keeps all of
internal/client's hardening:wrapandunwrap: up to 3 attempts, on a connection failure or HTTP 502, 503 or 504internal/client's tests moved to the SDK along with the code.One behavior change
The SDK passes
wrappedas decoded bytes.encryptencodes it back into the header as standard padded base64, the same string the API sent, so the file format is unchanged.decryptdecodes the header's value before unwrapping.As a result, a header whose wrapped DEK is not base64 is now refused locally as a damaged header: exit code 4, and no API operation is spent. Before, it was sent to the API and refused there, exit code 1.
TestHeaderRejectedcovers this with three new cases: not base64, unpadded, and line breaks only. The README anddocs/api-notes.mdare updated to match.Other changes
scripts/probe.gochecksRYPT_API_URLwithrypt.NewClientinstead ofclient.ParseBaseURL.User-Agentis nowrypt-cli/<version> rypt-go/v0.1.0.Testing
make vet test racepasses: every existinginternal/climock-API test andcmd/ryptend-to-end test is unchanged and green against the SDK.make integrationwas not run against the live API.🤖 Generated with Claude Code
https://claude.ai/code/session_01NTEjHbdKp83qgQgmqR1BJ6